Odtnhj

Here's the situation:

• We have some legacy system. Using simple User/Password authentication + session cookies. (And not using OpenAM)


• We are trying to provide new services to another orginazation and among other things, we are obliged to accept their users as authenticated, automatically, upon redirection from their web application. We need Federated Identity. And we have chosen OpenAM as our new IAM, but our user data is still in legacy system and their users will be registered into the legacy systems too. For now the users won't be aggregated into OpenAM's database

So the rough idea for any federation scenario for us would be like this:

They redirect their user to our OpenAM endpoint which takes a JWT (An OIDC token?) signed by their IdP, which we "trust", and somehow based on the content of that, OpenAM issues another JWT token & redirects the user again to the legacy system with the new bearer token.

Developers at the legacy system will create some custom code to verify and read the claims inside the JWT token. based on the claims, they create an authenticated, privileged session for the user.

I looked and found two possible solutions:

1. 
   

   The JWT from their IdP is used to start an OAuth2.0 implicit flow + using their JWT for client authentication (as per RFC-7523). Then the user will use the access token. But:

   
   
   
   • I want to put the claims from the first JWT (some of them are custom) into the access token so that the legacy system use that information to lookup the user in the legacy DB and create the session. How do I tell OpenAM to include these claims in the access token? Note that there are no information about their users in OpenAM database. Just the claims from the token.
   
   
   • Also looks like we are authenticating their IdP and not the user. Because the JWT client authentication uses their IdP's public key to verify the token's signature. How do I tell OpenAM that this token is meant for the "sub" of that JWT?
     
   
   



2. Use the Rest STS(Security Token Service) in OpenAM (OIDC -> OIDC). This kinda looks better suited for our situation but I don't know how to tell the OpenAM to verify their tokens. The documentation doesn't seem to provide any measures to verify the tokens? (Maybe some place to add their public key?)